RE: [sniffer] Rollback of bot rules..

Colbeck, Andrew Tue, 17 Jan 2006 15:43:02 -0800

Thank you, Pete.

In my spelunking, I've found too many rules to put in as panic entries
my .cfg file, and this morning I dropped the weight for my experimental
class tests to low values, and heavily edited my "combo" tests that
build on Sniffer hits.


I'm attaching a report showing the number of hits for the various rules
that I'm pretty sure are false positives, and this was from a modest
sample of my traffic.

Now that the source of the bad rules is gone, and I see that the latest
.snf update's file size has significantly shrunk, I'm going to find all
the rules that triggered tests 61 and 63 and re-queue them in my Declude
for scanning to get the false positives through my mail system.

Andrew.

 

> -----Original Message-----
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil
> Sent: Tuesday, January 17, 2006 2:06 PM
> To: [email protected]
> Subject: [sniffer] Rollback of bot rules..
> 
> Hello Sniffer Folks,
> 
>   There is an unknown problem with the bots surrounding SURBL and
>   SORBS testing. Rather than search for all the needles in all the
>   haystacks we are taking the following action:
> 
>   The bots will be offline until further notice - so all rules will be
>   those that are developed by our human rule-techs for the time being.
> 
>   All SURBL or SORBS related rules that were generated by bots in the
>   past 18 hours will be rolled into our Problematic rule group. This
>   is where rules go when they have been removed due to an FP - the
>   Problematic rule group does not get published - it simply prevents
>   rules from being duplicated.
> 
>   Since we have a huge backlog of false positive reports, it may take
>   a while to get through them all. Please be patient.
> 
>   The database changes will occur in the next half hour. All updates
>   after that time should have these troublesome rules removed.
> 
>   Once I resolve what happened to the bots I will let everyone know.
> 
> Thanks,
> _M
> 
> Pete McNeil (Madscientist)
> President, MicroNeil Research Corporation Chief SortMonster 
> (www.sortmonster.com) Chief Scientist (www.armresearch.com)
> 
> 
> This E-Mail came from the Message Sniffer mailing list. For 
> information and (un)subscription instructions go to 
> http://www.sortmonster.com/MessageSniffer/Help/Help.html
>

RE: [sniffer] Rollback of bot rules..

Reply via email to